Analysis
-
max time kernel
47s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 15:39 UTC
Static task
static1
Behavioral task
behavioral1
Sample
e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe
Resource
win10v2004-20221111-en
General
-
Target
e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe
-
Size
80KB
-
MD5
35e7e6980c5409ffcf9d5abee90dd52f
-
SHA1
6dfe037cb602faf01d0da4b8bc86b8d371f4ee4f
-
SHA256
e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db
-
SHA512
dc3aed042b1e37ac9d6948df75b988344995e09052c906cf7593fcb14780f03412fb1928ccc77aa92881220528a62abbb40d914bb0b262127118d2a24269d2e4
-
SSDEEP
1536:0Fz0LnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHMT:0Fz90hq+Yc7Hf4oa5r5sojsj+oMT
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/memory/1716-57-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat behavioral1/memory/1716-59-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat behavioral1/memory/1716-62-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B1DD4A9B = "C:\\Windows\\B1DD4A9B\\svchsot.exe" e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1716 wrote to memory of 684 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe 28 PID 1716 wrote to memory of 684 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe 28 PID 1716 wrote to memory of 684 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe 28 PID 1716 wrote to memory of 684 1716 e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe 28 PID 684 wrote to memory of 1180 684 net.exe 30 PID 684 wrote to memory of 1180 684 net.exe 30 PID 684 wrote to memory of 1180 684 net.exe 30 PID 684 wrote to memory of 1180 684 net.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe"C:\Users\Admin\AppData\Local\Temp\e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\net.exenet start "Task Scheduler"2⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start "Task Scheduler"3⤵PID:1180
-
-
Network
-
Remote address:8.8.8.8:53Requestzeyuansm.vicp.ccIN AResponsezeyuansm.vicp.ccIN A0.0.0.0